{
  "schemaVersion": "artifactDefinition.v2",
  "definitionId": "SOA.artifactDefinition.v2",
  "artifactId": "SOA",
  "title": "Statement of Applicability (SoA)",
  "artifactType": "Coverage",
  "format": "xlsx",
  "productTier": "Basic",
  "definitionRole": "contract",
  "sourceModel": {
    "body": "rendered human-readable register maintained in the Artifact Candidate page",
    "jsonDefinition": "machine-readable SoA contract and Annex A coverage model",
    "jsonExample": "curated realistic SoA data fixture"
  },
  "purpose": "Define the audit-ready Statement of Applicability contract. The SoA must justify applicability, implementation status, ownership, risk linkage, treatment linkage, and evidence for all 93 ISO/IEC 27001:2022 Annex A controls.",
  "completeCoverage": {
    "coverageType": "ISO/IEC 27001:2022 Annex A",
    "requiredControlCount": 93,
    "requiredControlRanges": [
      "A.5.1-A.5.37",
      "A.6.1-A.6.8",
      "A.7.1-A.7.14",
      "A.8.1-A.8.34"
    ],
    "rule": "The generated workbook and JSON Example must contain one row for every required Annex A control."
  },
  "controlledValues": {
    "theme": [
      "Organizational",
      "People",
      "Physical",
      "Technological"
    ],
    "applicability": [
      "Applicable",
      "Not applicable"
    ],
    "implementationStatus": [
      "Not started",
      "Planned",
      "In progress",
      "Implemented",
      "Not applicable"
    ],
    "evidenceStatus": [
      "Complete",
      "Partial",
      "Missing",
      "Not applicable"
    ],
    "decisionStatus": [
      "Approved",
      "Pending review",
      "Rejected",
      "Needs update"
    ]
  },
  "hintPolicy": {
    "storage": "Each content section stores its hint in this JSON Definition.",
    "visualization": "Generated outputs render each hint as a visually highlighted callout after the section content.",
    "minimumRule": "Every content section except formal title/document-control sections should have one context-specific hint.",
    "format": {
      "requiredParts": [
        "short practical explanation",
        "detailed book reference"
      ]
    }
  },
  "sections": [
    {
      "order": 1,
      "id": "title_page",
      "title": "Title Page",
      "contentType": "metadata",
      "required": true,
      "hint": null
    },
    {
      "order": 2,
      "id": "abstract",
      "title": "Abstract",
      "contentType": "narrative",
      "required": true,
      "hint": {
        "text": "Use the SoA as the formal bridge between risk treatment, Annex A control selection, implementation evidence, and audit justification.",
        "bookReference": "Volume 1, S-00-08-00 Annex A Controls"
      }
    },
    {
      "order": 3,
      "id": "document_control",
      "title": "Document Control",
      "contentType": "control_table",
      "required": true,
      "hint": null
    },
    {
      "order": 4,
      "id": "instructions",
      "title": "Instructions",
      "contentType": "ordered_list",
      "required": true,
      "hint": {
        "text": "Do not treat the SoA as a sample list. Every Annex A control requires an applicability decision and justification.",
        "bookReference": "Volume 1, S-00-08-00 Annex A Controls"
      },
      "intro": "Complete the Working sheets using the example tabs as a model. Follow the workbook usage rules below."
    },
    {
      "order": 5,
      "id": "soa_schema",
      "title": "SoA schema",
      "contentType": "schema_table",
      "required": true,
      "requiredColumns": [
        "Control ID",
        "Control name",
        "Theme",
        "Applicability",
        "Applicability justification",
        "Risk linkage",
        "Treatment linkage",
        "Implementation status",
        "Control owner",
        "Evidence status",
        "Evidence reference",
        "Last review date",
        "Next review date",
        "Decision status",
        "Notes"
      ],
      "hint": {
        "text": "The schema must support full Annex A coverage, applicability justification, evidence, ownership, and risk-treatment traceability.",
        "bookReference": "Volume 1, S-00-08-00 Annex A Controls"
      }
    },
    {
      "order": 6,
      "id": "soa_control_register",
      "title": "SoA control register",
      "contentType": "register_table",
      "required": true,
      "minimumExampleRows": 93,
      "columns": [
        {
          "name": "Control ID",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Control name",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Theme",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Applicability",
          "type": "select",
          "required": "yes",
          "valueSet": "domain.applicability",
          "options": [
            "Applicable",
            "Not Applicable",
            "Partially Applicable"
          ],
          "validation": {
            "allowBlank": false,
            "errorTitle": "Invalid value",
            "error": "Select a value from the list."
          }
        },
        {
          "name": "Applicability justification",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Risk linkage",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Treatment linkage",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Implementation status",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Control owner",
          "type": "select",
          "required": "yes",
          "valueSet": "domain.owner",
          "options": [
            "ISMS Manager",
            "Control Owner",
            "Risk Owner",
            "Process Owner",
            "Asset Owner",
            "IT Security",
            "HR",
            "Legal",
            "Executive Management",
            "Internal Audit"
          ],
          "validation": {
            "allowBlank": false,
            "errorTitle": "Invalid value",
            "error": "Select a value from the list."
          }
        },
        {
          "name": "Evidence status",
          "type": "select",
          "required": "yes",
          "valueSet": "domain.evidenceStatus",
          "options": [
            "Missing",
            "Requested",
            "Received",
            "Verified",
            "Rejected"
          ],
          "validation": {
            "allowBlank": false,
            "errorTitle": "Invalid value",
            "error": "Select a value from the list."
          }
        },
        {
          "name": "Evidence reference",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Last review date",
          "type": "date",
          "required": "yes"
        },
        {
          "name": "Next review date",
          "type": "date",
          "required": "yes"
        },
        {
          "name": "Decision status",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Notes",
          "type": "text",
          "required": "yes"
        }
      ],
      "hint": {
        "text": "The exported SoA must contain all 93 Annex A controls. Representative body rows are acceptable only if the JSON Example preserves complete coverage.",
        "bookReference": "Volume 1, S-00-08-00 Annex A Controls"
      }
    },
    {
      "order": 7,
      "id": "coverage_decision",
      "title": "Coverage decision",
      "contentType": "decision_table",
      "required": true,
      "fields": [
        {
          "name": "Coverage result",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Required controls",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Current controls",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Missing controls",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Reviewed by",
          "type": "text",
          "required": "yes"
        },
        {
          "name": "Decision date",
          "type": "date",
          "required": "yes"
        },
        {
          "name": "Evidence reference",
          "type": "text",
          "required": "yes"
        }
      ],
      "hint": {
        "text": "A complete SoA needs an explicit coverage decision confirming that no Annex A control is missing.",
        "bookReference": "Volume 1, S-00-08-00 Annex A Controls"
      }
    },
    {
      "order": 8,
      "id": "evidence_and_records",
      "title": "Evidence and records",
      "contentType": "evidence_table",
      "required": true,
      "intro": "Related records live in the companion documents named below. This file cites them by their approved version. It does not copy their content. The Owner named on the cover is accountable for those live records."
    },
    {
      "order": 9,
      "id": "external_references",
      "title": "References",
      "contentType": "reference_table",
      "required": true
    }
  ],
  "validationRules": [
    "JSON Example must contain definitionRef pointing to SOA.artifactDefinition.v2.",
    "JSON Example register sections must contain schemaRef pointing to the matching definition section.",
    "SoA control register must contain exactly 93 Annex A control rows.",
    "Every Annex A control from A.5.1 to A.8.34 must be present exactly once.",
    "Every control row must include applicability, justification, owner, implementation status, and evidence status.",
    "Applicable controls should link to risk or treatment evidence where relevant.",
    "No standalone Book reference section and no generic Sample placeholders are allowed."
  ],
  "instructionsForGenerator": [
    "Generate the Artifact Body after JSON Definition and JSON Example are complete.",
    "The Body may show representative rows, but XLSX generation must use the full 93-control JSON Example.",
    "Render section hints after section content as callouts with plain labels."
  ],
  "enrichment": {
    "source": "Contract.json",
    "method": "curated-json",
    "note": "Completes Contract JSON from MD-only schema/sections, removes duplicate alias sections, and normalizes string columns into structured column objects."
  },
  "editorialStandard": {
    "isoAnchors": [
      {
        "label": "ISO/IEC 27001:2022",
        "href": "https://www.iso.org/standard/82875.html",
        "role": "Normative source this artifact implements or cites."
      },
      {
        "label": "ISO/IEC 27001:2022 6.1",
        "href": "https://www.iso.org/standard/82875.html",
        "role": "Normative source this artifact implements or cites."
      },
      {
        "label": "ISO/IEC 27001:2022 7.5",
        "href": "https://www.iso.org/standard/82875.html",
        "role": "Documented information: identify, review and cite this workbook by version."
      }
    ],
    "bookSources": [
      {
        "series": "ISO 27001 for Software Companies",
        "volume": 1,
        "volumeTitle": "Building the ISMS",
        "chapterId": "S-00-08-00",
        "chapterTitle": "Annex A Controls",
        "primary": true,
        "role": "Primary operating chapter for this companion artifact.",
        "href": "https://www.amazon.com/dp/9789908983448"
      },
      {
        "series": "ISO 27001 for Software Companies",
        "volume": 1,
        "volumeTitle": "Building the ISMS",
        "chapterId": "S-00-03-00",
        "chapterTitle": "Planning, Risk & Objectives (Clause 6)",
        "primary": false,
        "role": "Documented information, review and version discipline.",
        "href": "https://www.amazon.com/dp/9789908983448"
      }
    ],
    "acronyms": [
      {
        "abbr": "ISMS",
        "longForm": "Information Security Management System"
      },
      {
        "abbr": "SaaS",
        "longForm": "Software as a Service"
      },
      {
        "abbr": "CIA",
        "longForm": "Confidentiality, Integrity, and Availability"
      },
      {
        "abbr": "CI/CD",
        "longForm": "Continuous Integration / Continuous Delivery"
      },
      {
        "abbr": "CI",
        "longForm": "Continuous Integration"
      },
      {
        "abbr": "CD",
        "longForm": "Continuous Delivery"
      },
      {
        "abbr": "ADR",
        "longForm": "Architecture Decision Record"
      },
      {
        "abbr": "AI",
        "longForm": "Artificial Intelligence"
      },
      {
        "abbr": "BCP",
        "longForm": "Business Continuity Plan"
      },
      {
        "abbr": "CRM",
        "longForm": "Customer Relationship Management"
      },
      {
        "abbr": "CSS",
        "longForm": "Cascading Style Sheets"
      },
      {
        "abbr": "DAST",
        "longForm": "Dynamic Application Security Testing"
      },
      {
        "abbr": "DLP",
        "longForm": "Data Loss Prevention"
      },
      {
        "abbr": "DR",
        "longForm": "Disaster Recovery"
      },
      {
        "abbr": "DRP",
        "longForm": "Disaster Recovery Plan"
      },
      {
        "abbr": "EDR",
        "longForm": "Endpoint Detection and Response"
      },
      {
        "abbr": "GDPR",
        "longForm": "General Data Protection Regulation"
      },
      {
        "abbr": "HR",
        "longForm": "Human Resources"
      },
      {
        "abbr": "IAM",
        "longForm": "Identity and Access Management"
      },
      {
        "abbr": "ICT",
        "longForm": "Information and Communications Technology"
      },
      {
        "abbr": "IR",
        "longForm": "Incident Response"
      },
      {
        "abbr": "IRP",
        "longForm": "Incident Response Plan"
      },
      {
        "abbr": "ISP",
        "longForm": "Information Security Policy"
      },
      {
        "abbr": "JSON",
        "longForm": "JavaScript Object Notation"
      },
      {
        "abbr": "MDM",
        "longForm": "Mobile Device Management"
      },
      {
        "abbr": "MFA",
        "longForm": "Multi-Factor Authentication"
      },
      {
        "abbr": "NDA",
        "longForm": "Non-Disclosure Agreement"
      },
      {
        "abbr": "PII",
        "longForm": "Personally Identifiable Information"
      },
      {
        "abbr": "RACI",
        "longForm": "Responsible, Accountable, Consulted, and Informed"
      },
      {
        "abbr": "RR",
        "longForm": "Risk Register"
      },
      {
        "abbr": "RTP",
        "longForm": "Risk Treatment Plan"
      },
      {
        "abbr": "SAST",
        "longForm": "Static Application Security Testing"
      },
      {
        "abbr": "SLA",
        "longForm": "Service Level Agreement"
      },
      {
        "abbr": "SoA",
        "longForm": "Statement of Applicability"
      }
    ],
    "must": [
      "Keep one live row per record on Working sheets. Do not merge several cases into one row.",
      "Example sheets must contain realistic Arcfield rows for every required sheet. Empty required cells are not an example."
    ],
    "mustNot": [
      "Do not invent live rows in the renderer. Example data lives in the Example JSON.",
      "Do not treat Ex example tabs as working sheets. Do not put live data on system sheets."
    ],
    "softwareCompanyAdaptations": [
      "Use Arcfield as the worked example (cover variant A).",
      "Name SaaS, CI/CD, privileged access or supplier interfaces in example rows where they affect this register."
    ],
    "exampleWorkbook": {
      "workedExampleOrg": "Arcfield",
      "requiredSheets": [
        "soa_schema",
        "soa_control_register",
        "coverage_decision"
      ],
      "minExampleRows": 93,
      "coverFromExample": true
    }
  },
  "editorialContractId": "editorial.xlsx.register.v1",
  "contentContractId": "content.register.coverage.v1"
}